Open Source Security
How to Audit npm Postinstall Scripts Safely
Inspect every lifecycle script in your node_modules tree, disable dangerous ones by default, and catch malicious postinstall hooks before they execute.
Feb 8, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedContainer Security
Chainguard Images: The Zero-CVE Container Base Image Revolution
Chainguard ships container images with zero known CVEs. That sounds like marketing until you understand how they build them. Here is the technical reality behind the claim.
Feb 8, 20266 min read
AI Security
AI Model Supply Chain Risks: Hugging Face and the New Attack Surface
As organizations download pre-trained models from Hugging Face and other model hubs, the AI supply chain introduces risks that traditional software security tools don't address.
Feb 8, 20265 min read
AI Security
MCP Server Multi-Tenant Isolation
Practical guidance on isolating tenants on shared Model Context Protocol servers, covering identity, data, compute, and observability boundaries at production scale.
Feb 8, 20267 min read
AI Security
RBAC & Scoping: Griffin AI vs Mythos
An AI that reads your security data needs the same access controls as a human analyst. Most pure-LLM vendors stop at the role name. Safeguard enforces the scope.
Feb 8, 20267 min read
AI Security
Griffin AI vs Gemini Function Calling: Security
Gemini's function calling is strong and flexible. Griffin AI's tool layer is narrow and opinionated. For security workflows, the opinionated approach wins.
Feb 8, 20268 min read
AI Security
Tool-Call Privilege Escalation In Practice
When an agent can call tools, the permission boundary is no longer between the user and the system. It is between the model's current beliefs and everything the model can reach. That is a much harder boundary to defend.
Feb 8, 20268 min read
Application Security
Security Considerations When Migrating from Monolith to Microservices
Decomposing a monolith into microservices changes the attack surface fundamentally. The security model that worked for the monolith will not work for the distributed system.
Feb 8, 20267 min read
Risk Management
Legacy Software and Supply Chain Risks
Legacy systems are supply chain time bombs—running outdated dependencies, unsupported frameworks, and unmaintained libraries. Here's how to manage the risk.
Feb 8, 20267 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.